PAS OptICS Keynote: Making Sense Of ICS Security Products

### Overview In this keynote address, Dale Peterson delivers a candid assessment of the industrial control system (ICS) security product landscape, focusing heavily on detection and asset management technologies. Peterson cautions asset owners against assuming security challenges can be solved merely by purchasing vendor products, noting that vendors deploy aggressive marketing targeting senior executives. He urges organizations to establish clear internal strategies and maintain an open mind regarding emerging technologies in operational technology (OT), noting that capabilities once deemed impossible for ICS (such as virtualization, cloud services, and active network polling) have routinely become viable.

### Key Topics - **Baseline ICS Defenses**: Beyond detection, Peterson highlights critical defense measures. He advocates replacing traditional antivirus with application whitelisting, implementing mandatory two-factor authentication (2FA) for remote access to combat credential-based intrusions, and evaluating perimeter options such as unidirectional data diodes (best for outbound flows like predictive maintenance) versus deep packet inspection for bidirectional cloud access. - **The Evolution of ICS Detection and Asset Inventory**: Around 2015, approximately 30 companies raised over $500M to develop passive network monitoring tools. However, many asset owners lacked mature detection response capabilities and instead adopted these tools primarily to obtain basic network-derived asset inventories. Over time, passive-only approaches gave way to active querying and configuration file parsing (such as project file extraction practiced by PAS), which provide significantly richer asset data. - **Separation of Asset Management and Detection**: Peterson asserts that passive/active detection solutions only provide partial asset inventory (lacking physical location, asset criticality, and ownership) and cannot replace comprehensive asset management, which encompasses change management and configuration management. He predicts that asset management and network detection will remain distinct, specialized product categories that integrate via APIs. - **Vulnerability and Incident Response Dynamics**: Detecting vulnerabilities requires tight coupling with systems that handle scheduling and patch application. Moreover, Peterson predicts detection product companies will increasingly transition into incident response service providers, providing tier-2 and tier-3 support because most asset owners cannot justify maintaining dedicated in-house ICS incident response teams. - **Architectural Commoditization**: Standalone physical sensor appliances connected to switch SPAN ports are expected to become obsolete as detection capabilities get embedded directly into network switches (as evidenced by Cisco acquiring Sentryo). Furthermore, proprietary vendor GUIs are losing value as enterprises route ICS telemetry directly into enterprise SIEM platforms like Splunk or IBM QRadar.

### Technical Details - **Data Ingestion & SIEM Integration**: Rather than operating dedicated OT Security Operations Centers (SOCs), organizations predominantly forward ICS detection alerts and asset context (e.g., Splunk OT add-on notables and QRadar feeds) to the central enterprise SOC via REST APIs. - **Active vs. Passive Collection**: Active interrogation uses native engineering workstation protocols or downloads and parses controller project files directly from programming servers, overcoming the visibility limitations of passive network sniffing. - **Evaluation Challenges**: Validating ICS detection tools via bake-offs is exceptionally resource-intensive (taking hundreds or thousands of hours) due to the absence of active attacks on live production networks, unlike asset inventory tools which can be evaluated immediately by comparing discovered assets.

### Takeaways Peterson recommends asset owners prioritize investments sequentially: (1) implement a dedicated asset management solution first to achieve immediate operational value; (2) deploy a detection solution that integrates with asset management and captures forensic records; (3) retain a specialized external incident response firm familiar with the chosen detection tooling; and (4) complete integration into the enterprise SOC. Finally, he notes that vendors in both asset management and detection are converging on three client-driven capability areas: vulnerability management, risk scoring, and regulatory compliance (e.g., NERC CIP and IEC 62443).